OPNsense: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 12

• Unscored —
  CVE-2023-38997

  A directory traversal vulnerability in the Captive Portal templates of OPNsense Community Edition before 23.7 and Busin…

  Aug 9, 2023
• Unscored —
  CVE-2023-38998

  An open redirect in the Login page of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows …

  Aug 9, 2023
• Unscored —
  CVE-2023-38999

  A Cross-Site Request Forgery (CSRF) in the System Halt API (/system/halt) of OPNsense Community Edition before 23.7 and…

  Aug 9, 2023
• Unscored —
  CVE-2023-39000

  A reflected cross-site scripting (XSS) vulnerability in the component /ui/diagnostics/log/core/ of OPNsense Community E…

  Aug 9, 2023
• Unscored —
  CVE-2023-39001

  A command injection vulnerability in the component diag_backup.php of OPNsense Community Edition before 23.7 and Busine…

  Aug 9, 2023
• Unscored —
  CVE-2023-39002 Scanner template

  A cross-site scripting (XSS) vulnerability in the act parameter of system_certmanager.php in OPNsense Community Edition…

  Aug 9, 2023
• Unscored —
  CVE-2023-39003

  OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 was discovered to contain insecure permission…

  Aug 9, 2023
• Unscored —
  CVE-2023-39004

  Insecure permissions in the configuration directory (/conf/) of OPNsense Community Edition before 23.7 and Business Edi…

  Aug 9, 2023
• Unscored —
  CVE-2023-39005

  Insecure permissions exist for configd.socket in OPNsense Community Edition before 23.7 and Business Edition before 23.…

  Aug 9, 2023
• Unscored —
  CVE-2023-39006

  The Crash Reporter (crash_reporter.php) component of OPNsense Community Edition before 23.7 and Business Edition before…

  Aug 9, 2023
• Unscored —
  CVE-2023-39007 Scanner template

  /ui/cron/item/open in the Cron component of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 a…

  Aug 9, 2023
• Unscored —
  CVE-2023-39008

  A command injection vulnerability in the component /api/cron/settings/setJob/ of OPNsense Community Edition before 23.7…

  Aug 9, 2023

Revision history

1. 2023-08-09 #1

   Initiale Fassung

References

• OPNsense Security Notification vom 2023-08-09
  https://github.com/advisories/GHSA-pwq6-w399-r46m
• OPNsense Security Notification vom 2023-08-09
  https://github.com/advisories/GHSA-jxgw-xv3v-x4jj
• OPNsense Security Notification vom 2023-08-09
  https://github.com/advisories/GHSA-h44v-883g-x8c3
• OPNsense Security Notification vom 2023-08-09
  https://github.com/advisories/GHSA-g5mw-r3hw-p72x
• OPNsense Security Notification vom 2023-08-09
  https://github.com/advisories/GHSA-963v-3mp2-58qm
• OPNsense Security Notification vom 2023-08-09
  https://github.com/advisories/GHSA-663h-c67h-phf7
• OPNsense Security Notification vom 2023-08-09
  https://github.com/advisories/GHSA-58fg-qwhp-cmjh
• OPNsense Security Notification vom 2023-08-09
  https://github.com/advisories/GHSA-2phw-mm8g-9jp8
• OPNsense Security Notification vom 2023-08-09
  https://github.com/advisories/GHSA-wm32-j2xh-9mq5
• OPNsense Security Notification vom 2023-08-09
  https://github.com/advisories/GHSA-xw95-hgq7-7c3x